Electronic mail (“e-mail”) messages may be encoded using one of a number of known protocols. Some of these protocols, such as Secure Multiple Internet Mail Extensions (“S/MIME”) for example, rely on public and private encryption keys to provide confidentiality and integrity, and on a Public Key Infrastructure (PKI) to communicate information that provides authentication and authorization. Data encrypted using a private key of a private key/public key pair can only be decrypted using the corresponding public key of the pair, and vice-versa. The authenticity of public keys used in the encoding of messages is validated using certificates. In particular, if a user of a computing device wishes to encrypt a message before the message is sent to a particular individual, the user will require a certificate for that individual. That certificate will typically comprise the public key of the individual, as well as other identification-related information.
If the requisite certificate for the intended recipient is not already stored on the user's computing device, the certificate must first be retrieved. Searching for and retrieving a certificate for a specific recipient is a process that generally involves querying a certificate server by having the user manually enter the name and/or e-mail address of the intended recipient in a search form displayed on the computing device. Generally, certificates located in the search are then temporarily downloaded to the computing device for consideration, and a list of located certificates may then be displayed to the user. Selected certificates in the list may then be manually identified by a user for storage in a non-volatile store of the computing device, for potential future use.
In some implementations, however, instead of temporarily downloading all the certificates located in the search to the computing device in the first instance, only certain data needed to generate a list of certificates located in the search may be initially downloaded to the computing device. The list is displayed to a user, typically identifying each located certificate using the common name and e-mail address of the individual to whom the respective certificate has been issued. Only after the user selects specific certificates from the list to be stored for future use are the certificates downloaded to the computing device for storage. In particular, if the computing device is a mobile device, deferring the downloading of certificates to the mobile device, and only downloading the user-selected certificates, can significantly minimize waste of resources.
Unfortunately, in these implementations where the downloading of certificates is deferred, it is generally not possible to determine with certainty whether any of the certificates identified in the list are already stored in a certificate store of the computing device from only the downloaded data used to generate the list. For example, in order for an application on the computing device to be able to determine with certainty that a given certificate identified in the list is already stored in the certificate store, the actual certificate would typically need to be downloaded to the computing device so that the requisite data needed to make the determination can be obtained. This can be a time-consuming and expensive task (e.g. with respect to bandwidth), and may be wasteful if the downloaded certificate is, in fact, already in the certificate store.